MAL-2026-6324

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/web3-crypto-address-utils/MAL-2026-6324.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-6324
Published
2026-06-23T15:57:08Z
Modified
2026-06-23T17:01:26Z
Summary
Malicious code in web3-crypto-address-utils (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (36cd7750ff28e527c0a147330b21275364e997713a22a026e74dffb81cb9b123)

web3-crypto-address-utils@0.1.0 advertises itself as a multi-chain wallet address validator but ships an active crypto stealer that fires automatically on npm install. The postinstall hook runs src/cache-manager.js, which detaches a backgrounded node src/system-monitor.js (via start /B... > ~/.web3-cache.log 2>&1 on Windows or trailing & on Unix), so the malicious daemon survives the install and persists in the user's session. After a 7-day dormancy designed to bypass CI/sandbox/review windows (BEACON_DELAY: 604800000), system-monitor.js polls the clipboard every 500ms and (1) detects ≥12 BIP39 words or 0x / WIF private-key patterns and POSTs them to the hardcoded IP https://2.27.62.51:8443/api/v1/telemetry with rejectUnauthorized: false, and (2) when the clipboard holds an ETH address, overwrites it via PowerShell Set-Clipboard with the attacker's address 0x40c4121D89cb06A0254C1885e49BE90753a5A961 (BTC and TRX attacker wallets are also embedded), redirecting the victim's outgoing transactions to the attacker. The validator code in index.js is a cover story; the package's real purpose is install-time deployment of a clipboard hijacker and seed-phrase exfiltrator on every installer's machine.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-007255",
            "import_time": "2026-06-23T16:54:12.041711104Z",
            "modified_time": "2026-06-23T15:57:08Z",
            "sha256": "36cd7750ff28e527c0a147330b21275364e997713a22a026e74dffb81cb9b123",
            "source": "amazon-inspector",
            "versions": [
                "0.1.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / web3-crypto-address-utils

Package

Name
web3-crypto-address-utils
View open source insights on deps.dev
Purl
pkg:npm/web3-crypto-address-utils

Affected ranges

Affected versions

0.*
0.1.0

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "src/cache-manager.js",
            "sha256": "fc604f8d013ac6ce57aa444134c67664e584dfcb34f3418b4dbc995954eccf2f",
            "tlsh": "4df0e1459792a374a1317ae4cb9e4137151f8123b214ff84badc86c01f521608bb2df8"
        },
        {
            "path": "src/system-monitor.js",
            "sha256": "9966976245fb0ea690f90eb567130aaa538bf99d1d75f5d34a2e701f0cb0d263",
            "tlsh": "419230f5b2988b1f2422bc7bf4008509a0aa8e4d89aeddd0f59f4d34df85209bd7f594"
        },
        {
            "path": "package.json",
            "sha256": "600e318dc67a0d06812f9181aa27f8ce82c81242306e4ceb5835ee932e4fc60a",
            "tlsh": "5ff05c128a117d631be826a9197980567a614dd70058f81d23db505a43ee2b2cdfa618"
        }
    ],
    "package_integrity": [
        {
            "filename": "web3-crypto-address-utils-0.1.0.tgz",
            "hashes": {
                "sha1": "a35b0d44cc95f85a95e2b775f4a867eb0c949c6d",
                "sha512_sri": "sha512-6JhLawiTne9mbVGNGhbBd79K9KTiDVUS7yoLAQI+wqi7mwJ3Ek6IEQEPRwg88KvkQXtfQT3MTeFX3pSkF3e75Q=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/web3-crypto-address-utils/MAL-2026-6324.json"